L Group
Intelligence Assessment
L Group is a financially motivated ransomware operation. The group is currently active and has demonstrated a high volume of recent attacks.
The group has targeted 26 victims in the last 90 days across sectors including Retail & E-Commerce, Professional Services, and Technology, primarily in the US, Brazil, and Canada.
With 26 attacks recorded in the last 90 days and a most recent attack on 2026-08-06, the actor is currently active.
Threat Analysis
L Group is a ransomware operation that deploys encryption-based extortion against organizations globally. This group maintains a data leak site (DLS) to pressure victims into paying ransom demands.
Financially motivated threat actors like L Group prioritize monetary gain through methods such as ransomware deployment, banking trojans, cryptocurrency theft, BEC scams, or credential harvesting for resale on underground markets.
Ransomware Victims (26)
CTIWATCH tracks 26 organizations claimed as victims by L Group on its data leak site, with attack dates, sectors and countries.
View full victims list →